WhatsApp is a freeware messaging platform founded in January 2009 by Brian Acton and Jan Koum. Since its original incarnation as a status notification app, the platform
has steadily grown in popularity; currently boasting a user base of 2 billion people [2] and achieving the 4th most downloaded app globally in 2022 [1]. While the app's features,
user interface, and large user base make it an appealing platform for communication, Signal proves to be a superior alternative with significantly better privacy policies.
An Overview of WhatsApp Data Privacy
Let's start with the good news: the content of your chats and calls are end-to-end encrypted and and can only be accessed by recipients in the conversation.
WhatsApp uses a very sophisticated and secure encryption algorithm which provides confidentiality, integrity, authentication, forward secrecy, and post-compromise security [10]
(side note - we'll talk about this more down below).
However, WhatsApp can still gather a lot of other personal information. The app requires you to share key details, such as the phone numbers of you and your contacts on WhatsApp,
how often you open the app, your approximate location, the battery level of your phone [3], and your public IP address [8].
Though the contents of calls and messages are encrypted, the data about this data (ironically called "metadata") is not encrypted; meaning details such as whom you chatted with and
how long your WhatsApp call lasted are not secured. This metadata is still surprisingly sensitive and can be revealing, as demonstrated from the U.S. government databases of Americans’ calls and emails [3].
Users do have control over some aspects of their data, including backup policies and automation deletion of messages. For those who use the Backup feature, messages and media are stored in
a cloud where it is easily accessible by law enforcement [8].
At a glance, WhatsApp's privacy policies leave something to be desired, but don't seem as invasive as other platforms.
Unfortunately, this is not the entire picture. In 2014, Facebook Inc. (now known as Meta Platforms) bought WhatsApp for 19 billion dollars, as it saw the opportunity to capitalize
on the platform's large user base and their data. Although founders Acton and Koum originally stayed on to continue developing the app, they decided to leave the company in 2017 after a series
of policy changes directly conflicted with their core values [11]. Another major updates to WhatsApp's terms of service and privacy policy occurred in January of 2021, as the app
would share the collected data with its parent company Meta (then Facebook) [13].
Ultimately, it is impossible to assess WhatsApp's privacy policies without first looking at the privacy policies of its parent company. So, with that being said... should Meta be trusted?
Should Meta Be Trusted?
The short answer is... No.
Over the past several years, Meta Platforms has been the subject of many public scandals and reports. These include (but are not limited to):
- Facebook's well documented involvement in the NSA's PRISM program [14]
- A report by Rolling Stone Magazine revealing details of an unreported FBI document where the bureau touts how easy it is to access WhatsApp messages in real time [8]
- Facebook Messenger's call-out by OpenDemocracy for its excessive data collection, which included: name, email, location, user ID, iMessage, photos and videos, health and fitness, and more [4]
- The very public Cambridge Analytica scandal, where Facebook shared personal data without users' consent [5]
- The malpractice suit against WhatsApp from this past year for breaching the GDPR and its obligations in relation to transparency (and only two weeks after being fined €390 million for Facebook and Instagram engaging in the same malpractice) [8]
- Reports that detail that scale of the metaverse's expansion of invasive tools, which will implement “many, many more sensors in our homes and our workplaces.” [6]
- The recent scandal associated with whistleblower Frances Haugen who claimed that the company “undermined democracy” and “harms children” in the pursuit of “astronomical profits”. Haugen leaked thousands of pages of private documents that revealed the extent of which Facebook has been aware of its damaging actions [7]
While there are many appealing features to WhatsApp, there are many reasons to be wary of its parent company's relationship to personal data. It is at this point that it is fitting to introduce
an appealing alternative... Signal.
Description and Benefits of Signal
Signal, despite having questionable ties to the CIA in its formative years [9], has proven to be the undeniable best choice for secure instant messaging and video calling.
After leaving WhatsApp in 2017, the app's co-founder Brian Acton founded the Signal Foundation to keep the original vision of WhatsApp alive via Signal.
Signal's end-to-end encrypted double ratchet algorithm (aptly named the Signal Protocol) is generally seen as the gold standard for secure communication and has been widely adopted by
other platforms such as Google's messaging app Allo, Facebook Messenger, and believe it or not, WhatsApp.
The Signal source code is open source, meaning that there is complete transparency in how it operates.
This allows developers to examine the code to spot any potential security issues, and to confirm that the app is as private and secure as it claims.
What's more, Signal stores the bare-minimum information on its servers. Messages are deleted on their servers once the content is delivered to the intended recipients, and is deleted
after 21 days if the message cannot be deleted [12]. In terms of metadata, the only data that is kept is the timestamp of when a user account was first created and when the user was last online [13].
The Other Perspective and Final Thoughts
As clear cut as the argument of Signal over WhatsApp may be, I also recognize that there are many who aren't so keen to abandon WhatsApp.
At the end of the day, it is much more convenient. WhatsApp is orders of magnitude more popular than Signal, and group communication becomes a lot easier with a
platform that your friends and family likely have already downloaded. Signal will likely never be able to compete with the resources available to WhatsApp, and that
translates to a much better user experience in WhatsApp. This alone may be enough to dissuade people from downloading Signal.
However, Signal remains a viable and privacy conscious alternative that is only growing in popularity. The Signal user experience may be barebones compared to WhatsApp,
but it still maintains most of the larger app's core functionality. As a final thought, I ask you, dear reader, why not make the change today?
Go Back Home
Sources
[1] - Business of Apps - Most Popular Apps (2023)
[2] - WhatsApp - About WhatsApp
[3] - The Washington Post - The Truth About WhatsApp’s and Apple’s Privacy Promises
[4] - Financial Review - TikTok’s ‘Alarming’, ‘Excessive’ Data Collection Revealed
[5] - The New York Times - How to Claim Your Share of Facebook’s $725 Million Privacy Settlement
[6] - Forbes - Why Facebook’s Metaverse Is A Privacy Nightmare
[7] - Big 3 Media - A Brief History of Meta and The Evolution of Facebook
[8] - Privacy Hub - Meta Fined €5.5 Million By Irish Regulators For Data Malpractice
[9] - Yasha Levine - Signal is a Government Op
[10] - SoK: Secure Messaging
[11] - Forbes - Exclusive: WhatsApp Cofounder Brian Acton Gives The Inside Story On #DeleteFacebook And Why He Left $850 Million Behind
[12] - Reddit - How Long Do Signal Messages Stay on the Server?
[13] - Privacy Hub - Who Owns the Signal App & Is It Safe?: A Closer Look at the Privacy-Centric Messaging App
[14] - Yahoo News - How Google and Facebook Cooperated with the NSA and PRISM
